CVE-2007-3285: Medium severity Microsoft Windows vulnerability
Published Jun 20, 2007
·Updated
Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.
Affected Software
45 affected components
Microsoft Windows
Mozilla Firefox<=2.0.0.4
Mozilla Firefox=0.8
Mozilla Firefox=0.9
Mozilla Firefox=0.9.1
Mozilla Firefox=0.9.2
Mozilla Firefox=0.9.3
Mozilla Firefox=0.10
Mozilla Firefox=0.10.1
Mozilla Firefox=1.0
Mozilla Firefox=1.0.1
Mozilla Firefox=1.0.2
Mozilla Firefox=1.0.3
Mozilla Firefox=1.0.4
Mozilla Firefox=1.0.5
Mozilla Firefox=1.0.6
Mozilla Firefox=1.0.7
Mozilla Firefox=1.0.8
Mozilla Firefox=1.5
Mozilla Firefox=1.5.0.1
Mozilla Firefox=1.5.0.2
Mozilla Firefox=1.5.0.3
Mozilla Firefox=1.5.0.4
Mozilla Firefox=1.5.0.5
Mozilla Firefox=1.5.0.6
Mozilla Firefox=1.5.0.7
Mozilla Firefox=1.5.0.8
Mozilla Firefox=1.5.0.9
Mozilla Firefox=1.5.0.10
Mozilla Firefox=1.5.0.11
Mozilla Firefox=1.5.1
Mozilla Firefox=1.5.2
Mozilla Firefox=1.5.3
Mozilla Firefox=1.5.4
Mozilla Firefox=1.5.5
Mozilla Firefox=1.5.6
Mozilla Firefox=1.5.7
Mozilla Firefox=1.5.8
Mozilla Firefox=2.0
Mozilla Firefox=2.0-beta1
Mozilla Firefox=2.0-rc2
Mozilla Firefox=2.0-rc3
Mozilla Firefox=2.0.0.1
Mozilla Firefox=2.0.0.2
Mozilla Firefox=2.0.0.3
Event History
Jun 20, 2007
CVE Published
07:30 PM
Data Sourced
07:30 PM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-3285?
CVE-2007-3285 has a moderate severity level due to potential security bypass leading to arbitrary code execution.
2
How do I fix CVE-2007-3285?
To fix CVE-2007-3285, upgrade Mozilla Firefox to version 2.0.0.5 or later.
3
What versions of Mozilla Firefox are affected by CVE-2007-3285?
All versions of Mozilla Firefox prior to 2.0.0.5 are affected by CVE-2007-3285.
4
What type of attack does CVE-2007-3285 facilitate?
CVE-2007-3285 facilitates remote code execution via a manipulated URI.
5
Is CVE-2007-3285 specific to any operating system?
Yes, CVE-2007-3285 specifically affects Mozilla Firefox running on Windows.